Privacy policy
This English translation is provided for information only. The French version is the only legally binding one.
What we collect, why, for how long, who handles it, and how you stay in control. In sentences, not clauses.
1. Who processes your data
The controller is the publisher of the site, identified in the legal notice. For any question about your data or to exercise your rights: [email protected].
We are the controller for your account, the commercial relationship, the security of the service and audience measurement. For the personal data your organisation places in the service (members, inventories, comments, cases, registers, incidents), we act as processor, on its instructions (section 10).
2. What we collect, and why
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Account: email, name, hashed password, 2FA secret | Identify you and secure access | Performance of the contract | Lifetime of the account, then 30 days |
| Stack inventory: vendors, products, versions; monitored URLs | Match published CVEs against your components | Performance of the contract | Lifetime of the account, immediate deletion on request |
| Alerts, cases, comments | Track how a vulnerability is handled as a team | Performance of the contract | Lifetime of the account |
| NIS2 registers: accepted risks, suppliers, incidents, reviews | Keep your registers and produce your evidence | Performance of the contract | Lifetime of the account; an organisation holding an incident register can only be deleted after exporting it |
| Discussions: end-to-end encrypted content of messages, reactions and edits | Relay messages between the members of a channel | Performance of the contract | As long as the channel exists; deleted with it |
| Discussions: metadata (author, channel, date and time, message size, people mentioned, channel members) | Order and deliver messages, enforce rights, notify mentions | Performance of the contract | As long as the channel exists; read mention notifications: 90 days |
| Discussions devices: device name, public signing key, creation and last-activity dates | Authorise the devices that are members of a channel | Performance of the contract | Lifetime of the account |
| Presence: online, away, busy, offline | Show who is available | Performance of the contract | Not stored: expires 60 seconds after the last signal |
| Exchanges with support: messages, contact details | Handle your request | Performance of the contract | Lifetime of the account, unless stated otherwise |
| AI features: requests sent to Vigie and technical context | Produce the assistant's reply | Performance of the contract | With us: private conversation kept in your browser tab, usage counters; with the AI provider: according to its terms |
| MCP connector (Claude or another MCP client): authorized application, chosen organization, granted permissions, grant and last-use dates; access and refresh tokens, stored hashed | Let the application you authorize act on your behalf, with your permissions; let you revoke this access | Performance of the contract | Authorization: until revoked, at the latest with the account; access token: 1 hour; refresh token: 30 days; expired tokens erased the next day |
| Notifications and emails sent | Notify you; investigate an email that was not received | Performance of the contract | Read notifications: 90 days (unread: kept); log of emails sent: 30 days (failures: 90 days) |
| Workflow runs | History and prevention of duplicate sends | Performance of the contract | 180 days; the traces that prevent duplicates are kept without their detailed log |
| Integrations and SSO: addresses and credentials of the tools you connect (ticketing, webhooks, GLPI, Intune, identity provider) | Make the integration work | Performance of the contract | Until deleted, at the latest with the organisation |
| Audit log: actor, action, timestamp | Trace sensitive actions, respond to an audit | Legitimate interest (security) | 30 days (Free) · 90 days (Pro) · 1 year (Team) · 5 years (Enterprise); a subscription taken out before October 2026 keeps the period of its original plan |
| Technical logs: IP address, user agent | Detect abuse, diagnose failures | Legitimate interest (security) | 12 months |
| Trial without an account: pasted content (manifest, SBOM, list), IP address | Analyse your stack without registration; limit abuse | Legitimate interest | Content: not stored; IP address: short-lived rate-limit counter |
| Partnership application: name, email, company, website, country, telephone, number of clients, message | Review your application and reply | Pre-contractual measures | For the time needed to review the application and, if accepted, for the duration of the partner relationship |
| Billing: company name, address, VAT number | Issue and keep invoices | Legal obligation | 10 years (French Commercial Code) |
| Account health (internal team tool): indicators aggregated per organization on adoption, risks (an administrator leaving, unpaid invoice, broken monitoring), outcomes and activity, never per person | Spot a customer at risk of losing their monitoring and offer help; notify the other administrators when an administrator leaves | Legitimate interest, balanced; no automated decision on access, plan or price; objection on simple request | Current score: as long as the organization exists; weekly history: 13 months |
| Audience measurement: cookieless by default, with cookies and session recording if you accept | Understand which pages are useful | Legitimate interest (cookieless measurement); consent (cookies, session recording) | 13 months |
Where no period is stated, data is kept for the lifetime of the account. Our daily backups are encrypted and rotated: deleted data may remain in them for up to twelve months before disappearing.
Deleting your account, or an organisation of which you are the only member, is requested from the application and confirmed through a link sent to your address. From the confirmation, the account is deactivated or the organisation made inaccessible; the data is erased 30 days later, a period during which support can cancel the deletion. What you wrote in a team's spaces stays with the team, without your name; the audit log keeps its entries, with the author anonymised.
3. Discussions: what end-to-end encryption changes
Discussions messages are encrypted in your browser before they leave, using the MLS protocol, and are only decrypted in the browsers of the channel's members. Your device's private keys stay in your browser and are never sent to us.
- What we store: the encrypted content, which we cannot read, and the metadata in the table above.
- What we cannot do: read, moderate, analyse or hand over to anyone the content of messages.
- On your device: the decrypted text is kept in your browser; “Forget this device” erases it.
- Exceptions: the private conversation with Vigie is not end-to-end encrypted (section 4); Vigie takes part neither in the organisation channel nor in direct messages; viewing a quoted record and your presence status go through our servers.
4. Artificial intelligence features
The Vigie assistant relies on an AI model provider that we choose and configure: Mistral AI by default (section 6). It only receives data when you use an AI feature:
- in a private conversation, your messages, the recent history of the conversation and technical context from the active project (components, alerts, end-of-life dates, articles), without any email address, member list or internal identifier added by us;
- for workflows and dashboards, public technical data or your request, with email addresses masked;
- for assisted remediation of a vulnerability on your fleet, technical data about the machines concerned (system, version of the affected software, available updates) and the output of the verification commands you confirmed, without machine names, IP or MAC addresses, user names or email addresses, which are replaced before sending.
If you connect an external AI assistant, such as Claude, through our MCP connector, you authorize it yourself, from the app, for an organization and permissions you choose; you can revoke this access at any time (Settings › Connected apps). We only receive this assistant's tool calls (the tool name and its parameters), never the rest of your conversations, and we read neither its memory nor its history. The responses we send back to it are then governed by the terms of that assistant's publisher, a tool you choose and not a subprocessor of TechWatchAlert.
We do not use your data to train a model. Retention and any reuse of data by the AI provider are governed by its own terms, applicable to the service we use. Do not send Vigie secrets or unnecessary personal data.
5. Exchanges with support
Exchanges with support, by email or by live conversation where offered, are not end-to-end encrypted: they are stored on our servers and read by authorised members of our support team to handle your request. They are kept for the lifetime of the account, unless stated otherwise. Do not send passwords, API keys or secrets.
6. Our sub-processors
The following providers process personal data on our behalf. Three of them are established outside the European Union; for each, the transfer is covered by a safeguard provided for by the GDPR.
- OVHcloud (OVH SAS, France): hosting of the servers, the database and our mail server, on infrastructure located in France (Paris region).
- Cloudflare, Inc. (United States): reverse proxy, page delivery and attack protection, in front of the site and the application. Cloudflare sees IP addresses, headers and request content pass through; Discussions content passes through it encrypted. Safeguards: certification under the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.
- PostHog, Inc. (United States, data hosted in the EU in Frankfurt): audience measurement for the site and the application, under the conditions in the table above. Safeguards: data processing agreement and standard contractual clauses.
- Mistral AI (France, hosted in the EU): default model provider for the “Vigie” assistant. Receives the data described in section 4, only when you use AI features, and processes it according to its terms. If we change provider, this list is updated before the switch.
- Paddle (Paddle.com Market Limited, United Kingdom): merchant of record, which collects payment, issues the invoice and processes billing data. We never see your card number. Safeguards: the European Commission's adequacy decision for the United Kingdom, or standard contractual clauses.
Emails (alerts and service messages) are sent from our own mail server, hosted by OVHcloud: no email delivery provider is involved. Our backups are encrypted on our servers before being copied to a storage provider, which does not hold the decryption key. Details, including security measures, are on the Security page. If this list were to change, it would be updated and customers notified before the switch.
The tools you connect to the service (Slack, Microsoft Teams, Discord, Jira, GitLab, GitHub, GLPI, Intune, your identity provider) are your own, not our sub-processors: the data you send them is governed by their terms.
7. What we do not do
- We do not sell any data, to anyone, in any form.
- We do not use your inventory, alerts, comments or exchanges with Vigie to train a machine learning model.
- We do not read your Discussions: end-to-end encryption prevents us from doing so.
- We place no advertising trackers, and no audience measurement trackers before you consent.
- We do not look at the content of your account, except at your explicit request for assistance, and such access is then recorded in the audit log.
8. Your rights
You have the right of access, rectification, erasure, restriction, objection and portability. The application's exports (Excel exports of CVEs and alerts, registers, PDF reports, the API depending on the plan) let you retrieve your data without writing to us. You can delete your account yourself (Settings › Security). For a full copy or any other right: [email protected]; we reply within one month. You may also lodge a complaint with the CNIL.
9. Security
AES-256 encryption at rest, TLS 1.3 in transit, end-to-end encryption of Discussions, TOTP two-factor authentication available on all accounts, short-lived access tokens, limits on login attempts, an isolated data network, an audit log of sensitive actions, encrypted daily backups. In the event of a data breach likely to result in a risk, we notify the CNIL within 72 hours and inform the people concerned.
10. Data processing agreement
When you use the service, we act as processor for the personal data you place in it. A data processing agreement (DPA) compliant with Article 28 of the GDPR can be signed on request: ask for it, with your own template if you have one. When an organisation is managed by a managed service partner, the partner and its client agree between themselves on their respective roles.
11. Changes
Any substantial change to this policy is announced to account holders by email at least thirty days before it takes effect. The date of the last update is shown at the top of the page.
- 8 October 2026: MCP connector (Claude and other clients): data processed, retention of authorizations and tokens, revocation.
- 3 October 2026: deletion of the account from the application, confirmed by email and effective 30 days later; anonymisation of the audit log.
- 2 October 2026: added end-to-end encrypted Discussions, presence, exchanges with support, AI features, the trial without an account, partnership applications, notifications and workflow runs, with their retention periods; clarifications on backups, account deletion and the AI provider.
- 23 September 2026: previous version.